GlobalProtect Best Practice

GlobalProtect Best Practice

6091
Created On 11/10/25 21:08 PM - Last Modified 04/27/26 23:04 PM


Symptom


  • This playbook provides a structured approach to deploying, configuring, and maintaining a secure and efficient GlobalProtect solution. By following these best practices, organizations can ensure robust remote access for their workforce while minimizing security risks.
    These configurations may require time and planning, and it is recommended to open a maintenance window to make any changes or test them.

Environment


  • PANOS
  • GlobalProtect

 

Resolution


1. Pre-Deployment Planning: Laying the Foundation

Before initiating the GlobalProtect deployment, a thorough planning phase is crucial. This ensures the solution aligns with your organization's security policies and user requirements.

1.1. Define User Access Needs:

  • Identify User Groups: Categorize users based on their roles and access requirements (e.g., employees, contractors, partners).

  • Determine Application Access: Specify which internal applications and resources each user group needs to access based on App-ID and ACE.

  • Least Privilege Principle: Grant users the minimum level of access necessary to perform their job functions.

  • Allow Inbound GlobalProtect traffic: To properly secure GlobalProtect, create a single, granular "Allow" policy from the "Outside" zone to the "GlobalProtect Public IP zone", which is crucial because the default intrazone rule does not log (but it can be configured to do so) or inspect traffic. Within this new policy, specify the App-IDs panos-global-protect, ssl, web-browsing, and paloalto-gp-mfa-notification   - [MultiFactor Authentication gateway (firewall) sends an UDP notification message to GlobalProtect client, when the client accesses a non-browser (such as SSH) based resource, to notify the client/end-user to authenticate first before accessing the resource]. It is also critical to apply your standard threat inspection profiles and if possible to restrict the "Source" to only the geographic regions where your organization operates. Do not apply a separate SSL Decryption policy, as inbound GlobalProtect traffic is implicitly decrypted as it terminates on the firewall.

  • Deny Unwanted Region Inbound GlobalProtect traffic (Required action if intra-zone is allowed): To further secure your firewall, create a "Deny" policy from the "Outside" zone to the "GlobalProtect Public IP zone" and place it directly above your GlobalProtect "Allow" rule. In this new deny rule, set the "Source" to the regions your organization does business with, but be sure to check the "negate" option, which makes the rule block all traffic except from those specified regions. Finally, add the App-IDs panos-global-protect, ssl, web-browsing and paloalto-gp-mfa-notification, and choose ‘any’ for the Service  to this rule, ensuring that unwanted traffic is explicitly denied before it can be processed by the default intrazone policy.

1.2. Architecture and Sizing:

  • Gateway Placement: Strategically deploy GlobalProtect gateways in locations that provide optimal performance and low latency for your user base. Consider geographic distribution for a global workforce.

  • Capacity Planning: Estimate the number of concurrent users and their expected bandwidth consumption to properly size your firewall and gateway resources.

  • High Availability (HA): Implement a high availability configuration for both the GlobalProtect portal and gateways to ensure uninterrupted service.

1.3. Authentication Strategy:

  • Multi-Factor Authentication (MFA): This is a non-negotiable best practice. Enforce MFA for all GlobalProtect users to add a critical layer of security beyond passwords.

    • Recommended Methods: Leverage modern authentication protocols like SAML or RADIUS to integrate with MFA providers such as Duo Security, Okta, or Microsoft Azure MFA.

  • Authentication Profiles: Configure authentication profiles to define the authentication methods and servers that GlobalProtect will use.

  • Implement Client Certificates: The user presents a client certificate along with a connection request to the GlobalProtect portal or gateway. The portal or gateway can use either a shared or unique client certificate to validate that the user or endpoint belongs to your organization. 

1.4. Certificate Management:

  • Publicly Trusted Certificates: Use certificates signed by a public Certificate Authority (CA) for the GlobalProtect portal and gateways. It lowers the chance of certificate errors, since trusted CA is (almost) always in the root store, but the issued cert can still expire if not renewed on time.

  • Certificate Lifetime: Establish a process for monitoring certificate expiration dates and renewing them in a timely manner.

Refer to GlobalProtect Certificate Best Practices for more information.


2. Deployment and Configuration Best Practice: 

This section outlines the key steps and recommended features to optimize the security of the core components of GlobalProtect.

2.1. Portal Configuration:

  • Authentication: Assign the previously configured authentication profile and/or certificate profile to the portal.

  • Agent Configuration:

    • Connect Method: For most use cases, "User-logon (Always On)" is the recommended connect method. This ensures that the VPN connection is established automatically upon user login, providing continuous protection. "Pre-logon" can be used to establish a connection before the user logs in, enabling tasks like remote scripting and patch management.

    •  if users are expected to access GP via captive portal enabled networks, please add Enabling Embedded Browser for Captive Portal as best practices and reference this document
    • Agent Update: Configure the portal to automatically download and install new GlobalProtect agent versions to ensure all users are running the latest, most secure client. Or set up different GlobalProtect agent upgrade options for different users  

2.2. Gateway Configuration:

  • Tunnel Settings:

    • IPSec/SSL: While both are supported, IPSec is generally recommended for better performance.

    • Tunnel Interface: Create a dedicated tunnel interface for GlobalProtect traffic.

  • Client IP Pools: Allocate a dedicated IP address pool for GlobalProtect clients to easily identify and apply security policies to VPN traffic. User-ID should be used in addition for more granular access. Furthermore, there are cases where the IP pool remains the same between the pre-logon and user-logon phases, and therefore, it is not recommended to solely rely on IP from a security policy perspective.

  • Split Tunneling:

    • Sending 0.0.0.0/0 default route doesn't necessarily imply all traffic will be routed through the tunnel. Users can have more specific routes or applications may bind to a specific interface ignoring routing table. It is encouraged to disable access to the local network. For more information here.

    • Split Tunneling (Use with Caution): If you choose to implement split tunneling, carefully define which traffic should go through the VPN (corporate resources) and which can go directly to the internet (e.g., streaming services). Be aware that this can introduce security risks if not configured properly.

  • Security Policy: Create granular security policies that define what applications and resources GlobalProtect users can access. Apply the same or higher level of security inspection to VPN traffic as you do to your internal network traffic. Remote users are generally compromised easier than having someone plug into the corporate network on-site 

 

2.3. User-ID Integration:

Integrating GlobalProtect with User-ID is essential for gaining visibility into user activity and enforcing granular, user-based security policies. This allows you to create policies based on user groups and identities rather than just IP addresses. 

 

  • Cloud Identity Engine (cloud-based service): CIE can help with Directory Sync, which provides user information, and supports authentication from your chosen identity provider (IdP) such as Okta, Azure Entra or other SAML and OIDC-based providers
  • Enable User-ID: Enable User-ID on trusted zones only. 

  • Enable User-ID: Enable User-ID on trusted zones only. 

  • Use Group-Based Policies: Instead of creating policies for individual users, leverage user groups from your directory service (like Active Directory) to simplify policy management and improve security.

  • Utilize the Allow List: In the Authentication Profile used for GlobalProtect, navigate to the Advanced tab and configure the Allow List. Add the specific User-ID groups that are permitted to connect. This acts as a preliminary check, ensuring that only users from authorized groups can even attempt to authenticate, effectively filtering access before it reaches your remote authentication server.

2.4. Host Information Profile (HIP):

  • Endpoint posture assessment: Use HIP to collect information about the security state of connecting end-point/user devices (e.g., OS version, antivirus status, disk encryption).

  • HIP Objects Information

2.5. Security Profiles:

 

3. GlobalProtect Security

To ensure that your GlobalProtect environment is configured securely and protected against attackers follow below security best practices.

3.1. Secure Management interface 

  • Do not expose the Firewall management interface to the open Internet, including Web, CLI or API. If it's accessible from the Internet, ensure that only trusted IPs can connect to the management interface.

  • Do not expose unnecessary HTTP, HTTPS, SSH, TELNET administrative management services in an Interface Management Profile attached to a public interface; and if needed, use the Permitted IP addresses under Interface Management Profile.

  • It is possible that misconfiguration can be present in GlobalProtect Portal and Gateway where Management Profile can be configured exposing management to the internet on port 4443. Please follow Set Up Access to GlobalProtect documentation. To confirm the management interface is not exposed externally via the GlobalProtect Portal or GlobalProtect Gateway, perform the following test: From a computer outside your network (and not connected on the GlobalProtect VPN), using an IP address not on the Trusted IP list, attempt to connect to the management interface on ports 4443 and 10443.
    Example Connection Attempts:

    • https://<GlobalProtect-Portal-IP>:4443
    • https://<GlobalProtect-Gateway-IP>:4443
    • https://<GlobalProtect-Portal-IP>:10443
    • https://<GlobalProtect-Gateway-IP>:10443

  • If this is accessible from the open Internet, ensure that trusted IPs are added to the Management Interface Settings Permitted IP Addresses (Device > Setup > Management > Permitted IP addresses)  as explained in the best practices below. 

  • Use GlobalProtect to connect to the management interface. Follow best practice for security Policies: Best practices for Securing the NGFW Management Interface

3.2. Apply Advanced Threat Prevention (ATP) Protections on GlobalProtect Interfaces

  • Advanced Threat Prevention (ATP) can be used to protect GlobalProtect interfaces from attacks and also to provide ATP protections against PAN-OS vulnerabilities. 

3.3. Protect Firewall and Internal Resources from DDoS Attack

  • To protect the NGFW running GlobalProtect against denial of service (DoS) and distributed denial of service (DDoS) attacks refer to the following guide.

3.4. Disable Portal Web login

  • If end-users do not require direct access to the web interface of the GlobalProtect portal you can disable it. This is applicable if all your users already have the GlobalProtect client already installed as part of your normal end-user device provisioning.

 

4. Monitoring and Troubleshooting: Maintaining a Healthy VPN

Proactive monitoring and a clear troubleshooting plan are essential for maintaining a reliable GlobalProtect service.

1. It is recommended to use the preferred GlobalProtect release, whether it is a new deployment or an upgrade. If a non-preferred version release is chosen, it is important to be aware of the potential impact on performance, stability, and security. The GlobalProtect App version information can be found here
2. Review release notes for known issues and changes to default behavior 
3. Ensure that critical GlobalProtect Processes are allowlisted in the 3rd party applications to prevent interoperability issues.
https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-apps/globaptorect-processes-to-be-whitelisted-on-edr-deployments

4. Do not have conflicting rules with other apps or drivers performing traffic steering (split-tunneling)
5. Follow GlobalProtect Upgrade Using Microsoft Intune for clean and reliable GlobalProtect upgrades on Windows OS. Follow Deploy the GlobalProtect Mobile App for macOS Using Jamf Pro for macOS. 
6. If Enforce GlobalProtect is used then it should exempt IP addresses and/or FQDNs or SAML IDP domains and any IP addresses which are required to successfully authenticate to GlobalProtect while enforcer is active.
7. Always do stage upgrades with limited sets of users who are technical and can provide relevant feedback. Ensure all key customer use-cases are working properly with these initial users. Once these users are fully working then expand the rollout further.

4.1. Logging and Monitoring:

  • Enable Logging: Ensure that you are logging all relevant GlobalProtect events. For instance, enabling session logging within GlobalProtect security policy to gain granular visibility into the transition between Pre-Logon and user-Logon phases during troubleshooting.

  • Capacity Monitoring:

  • Log Forwarding for remote monitoring


4.2. Common Troubleshooting Steps:

  • "Stuck on Connecting": This can be caused by various factors, including network issues, incorrect configurations, or software conflicts. Check the GlobalProtect logs on the client and the firewall for error messages.

  • Authentication Failures: Verify user credentials, check the status of your authentication servers, and ensure that the correct authentication profile is configured. Authentication failures can be related to a Brute Force Attack. Follow the guidance for how to mitigate from Bruce Force Attack. How to mitigate from Bruce Force Attack

  • Slow Speeds: Investigate potential bandwidth bottlenecks on the user's Internet connection, the corporate network, or the firewall itself. Also confirm if IPSec or SSL is used.

  • DNS Resolution Issues: Ensure that the GlobalProtect client is configured to use the correct DNS servers to resolve internal resources.


5. User Training and Communication: Empowering Your Workforce

  • Clear Instructions: Provide users with clear and concise instructions on how to install, configure, and use the GlobalProtect client.

  • Troubleshooting Guide for Users: Create a simple troubleshooting guide for common user-facing issues to reduce the burden on your IT support team.

  • Communicate Updates: Inform users about planned maintenance, upgrades, and any changes to the GlobalProtect configuration.

By implementing this best practice document, you can establish a secure, reliable, and user-friendly remote access solution with Palo Alto Networks GlobalProtect, enabling your workforce to be productive from anywhere while protecting your organization's valuable assets.

6. Additional Best Practices guidance

6.1 Best Practices References
Other users also viewed:
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1Ki000000TOJoKAO&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail